# Logstash filter not working with Sysmon

**URL:** <https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023>\
**Category:** Logstash\
**Created:** [April 15, 2020, 3:42am UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023 "2020-04-15T03:42:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![martinsrm](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@martinsrm](https://discuss.elastic.co/u/martinsrm)\
**Post date:** [April 15, 2020, 3:42am UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023/1 "2020-04-15T03:42:49Z")

</div>

Hello everybody,

I am trying to create a field called "Threat" just if I have a log from the "Microsoft-Windows-Sysmon" provider, but the "if" condition never works, could you guys give me an idea about it?

Tks

########################### logstash .conf file ########################

```auto
input {
      beats {
        port => 5044
      }
    }

    filter {
      if "Microsoft-Windows-Sysmon" in [provider_name] {
      #if [provider_name] == "Microsoft-Windows-Sysmon" {                                                                                                                                                                                            
        mutate { add_field => {"Threat" => "Test"} } }
    }

    output {
      stdout { codec => rubydebug }
    } 

```

############################ Logstash output #############################

```auto
"@version" => "1",
        "winlog" => {
              "channel" => "Microsoft-Windows-Sysmon/Operational",
            "record_id" => 9921,
                 "task" => "File created (rule: FileCreate)",
              "process" => {
            "thread" => {
                "id" => 3064
            },
               "pid" => 2392
        },
                  "api" => "wineventlog",
               "opcode" => "Info",
        "computer_name" => "MyVm",
        "provider_guid" => "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
                 "user" => {
            "identifier" => "S-1-5-18",
                  "name" => "SYSTEM",
                  "type" => "User",
                "domain" => "NT AUTHORITY"
        },
             "event_id" => 11,
        "provider_name" => "Microsoft-Windows-Sysmon",
           "event_data" => {
                   "RuleName" => "technique_id=T1044,technique_name=File System Permissions Weakness",
            "CreationUtcTime" => "2020-04-15 03:14:58.941"
        },
              "version" => 2
    },
    "@timestamp" => 2020-04-15T03:14:58.941Z,
         "event" => {
         "created" => "2020-04-15T03:15:00.766Z",
            "code" => 11,
        "provider" => "Microsoft-Windows-Sysmon",
          "action" => "File created (rule: FileCreate)",
          "module" => "sysmon",

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2020, 2:51pm UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023/2 "2020-04-15T14:51:17Z")

</div>

I do not think you have a [provider\_name] field, you have a [winlog][provider\_name] field.

---

<div class="post-metadata">

**Author:** ![martinsrm](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@martinsrm](https://discuss.elastic.co/u/martinsrm)\
**Post date:** [April 15, 2020, 4:36pm UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023/3 "2020-04-15T16:36:11Z")

</div>

Nice, it worked.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2020, 4:36pm UTC](https://discuss.elastic.co/t/logstash-filter-not-working-with-sysmon/228023/4 "2020-05-13T16:36:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.